CVE-2018-3909

An attacker sends a single TCP connection containing two pipelined HTTP requests. The first request carries the intended path (e.g., `PUT /cameras`), and the second request carries a different method (e.g., `GET /00000000-...`). Because the `on_message_complete` callback overwrites the stored method on each invocation, the server processes the path from the first request with the method from the second request, bypassing access controls or triggering unintended state changes [ref_id=1]. No authentication is required; the attacker only needs network access to the hub's video-core port (3000).

The vulnerability resides in the `on_message_complete` callback (`sub_415F4`) within the video-core HTTP server. At offset `[5]` (`STR R12, [R3,#0x20]`), the parsed HTTP method is written to a custom structure, but this field is overwritten on each invocation without regard for pipelined requests.

The advisory does not include a patch diff. The recommended remediation is to fix the `on_message_complete` callback so that it does not blindly overwrite the stored method when processing pipelined requests. Instead, the server should either reject pipelined requests entirely or maintain a per-request method context so that each request's method is preserved independently [ref_id=1].

Send a single TCP connection with two pipelined HTTP requests. For example: `echo -e "PUT /cameras HTTP/1.1\r\n\r\nGET /00000000-0000-0000-0000-000000000001\r\n\r\n" | nc 127.0.0.1 3000`. The server will process the path from the first request with the method from the second request, as shown in the Talos PoC [ref_id=1].